{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ceb8747d-75d8-5c75-bfd0-0798ffbed6e6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-indexer", "purl": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10", "version": "6.0.16-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-context-indexer", "purl": "pkg:maven/org.springframework/spring-context-indexer@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:5344863a-54c3-5cd2-9a7e-a441c7dea417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c924ddbf-bced-543b-9639-4fc5d0df27b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:0709183d-a817-5a72-915e-a65e240da682", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:1abe9cea-3665-53c3-a3ad-3e1aa8802bb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:65264ee1-79ed-57ef-8c6f-e821a97592e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:8acf6172-128e-59d2-a472-7e36b3f2180b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:537afb96-1b91-5fd5-a107-3ddca9967252", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6acdb832-b2d4-56a5-89aa-ed4f939bfa23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:692fad96-0f55-533f-9bc6-0783014c9cc6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ed040628-7061-5fea-bad1-bd2f11775361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:09a517d4-8c10-5513-877f-0def3b3264ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:32328a28-9a40-5aba-847f-f290a058d21f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:34a7405a-e22c-5f98-875e-d7cbb8e76508", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fa657708-b619-52fb-8411-b5f09a71b5e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e9ecd060-b1a1-5104-ae1d-c18a6f6881f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:2f7dc334-861e-5cd0-924d-b29638b08e3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6498300c-71e3-594f-88cf-032eabd3f37b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c50c7148-4440-5b90-bc9a-5b4552b058fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:26a2b8e9-1e68-5af1-bc59-f8b8baaf2383", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:4d027609-2d03-595a-8550-47310f75e28f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:7291550d-17d6-595b-8c51-45bc878d656d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b6aaddb1-f190-50c9-9c98-d07a30c08bea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9d4d11a8-13a8-5a6a-b238-b447570e81e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6cce8566-a236-5ce9-a631-e26cb7ea1e76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:fce9f37a-8b13-57d8-b56a-dea5ce07365c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f404e947-cbed-599a-8989-80f50c740731", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ceeb4fa5-e1bf-5343-86c6-b413be8c24ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:324754a3-5986-5080-9084-f8c8ea3f90e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:e4b49ad8-b22b-5a7a-9678-534b771d1922", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:bf5ee093-b653-54fa-8b7d-5d088cb76dd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:45c0a8ab-1318-5d8f-a76a-05f2cf1548c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:dad735ed-5fe6-57c6-9ac4-c54252345e04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:6252d2e6-ff4e-5466-a4f4-2ac5c3f61b0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:af0fe1bc-4a4d-5fe4-80bc-663be711be2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:ce9c79c0-7526-5eec-8d26-e0f47574a59e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:f8c77e5f-a7e7-5f23-b7a4-dcb60585adaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:b44c4ce1-8dac-5b48-be31-56f7065a6215", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:caa6da13-38af-5327-9831-f96167a01e1c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:a2609d53-0c06-5843-b703-d1762ceeaf3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:88ee9de9-196a-503f-b585-48bde9cfc1d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:38be840e-ce58-5de9-a397-95aee3bdeb82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:04f48b48-3cf4-5e22-b5ac-7ecfa757448d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9cc7f96d-55ac-55eb-8b41-2f4f8fad0973", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:c63b0648-99ea-52fc-860d-18f4f3c30d20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:9380118f-4a13-5921-84ab-96a953d647f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:d513660a-42d9-5755-b143-f67759d6ee3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ], "bom-ref": "urn:uuid:37ec8d69-bf3e-54e7-9e62-5916c532c431", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.10 of org.springframework:spring-context-indexer." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@6.0.16-tuxcare.10" } ] }